audit: type=1400 audit(1560808881.079:5): avc:  denied  { set_context_mgr } for  pid=2068 comm="syz-executor945" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1
audit: type=1400 audit(1560808881.089:6): avc:  denied  { call } for  pid=2068 comm="syz-executor945" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1
audit: type=1400 audit(1560808881.089:7): avc:  denied  { transfer } for  pid=2068 comm="syz-executor945" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1
------------[ cut here ]------------
kernel BUG at drivers/android/binder_alloc.c:1103!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 2068 Comm: syz-executor945 Not tainted 4.9.182+ #1
task: 00000000a092101a task.stack: 0000000089c3d64b
RIP: 0010:[<ffffffff8222ac1b>]  [<0000000078a38229>] binder_alloc_do_buffer_copy+0xcb/0x500 drivers/android/binder_alloc.c:1103
RSP: 0018:ffff8801cefa74a8  EFLAGS: 00010293
RAX: ffff8801cfce5f00 RBX: 0000000020001000 RCX: 00000000000000e8
RDX: 0000000000000000 RSI: ffffffff8222ac1b RDI: ffff8801d4cf3f58
RBP: ffff8801cefa7528 R08: ffff8801cefa75a8 R09: 0000000000000008
R10: ffffed0039df4f12 R11: ffff8801cefa7897 R12: 0000000000000078
R13: 00000000000000e8 R14: 0000000000000008 R15: ffff8801cefa75a8
FS:  00000000006f8940(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001ce780000 CR4: 00000000001606b0
Stack:
 ffff8801cefa7560 0000000000000246 ffff8801cfce5f00 ffff8801cefa74d0
 ffff8801d0a4c018 ffff8801d4cf3a58 00ff8801cefa7870 ffff8801d4cf3a00
 ffffffff814fc356 ffff8801cfc91d00 00000000000000e8 ffff8801cefa75a8
Call Trace:
 [<00000000430375e3>] binder_alloc_copy_from_buffer+0x37/0x42 drivers/android/binder_alloc.c:1149
 [<000000009cd3e344>] binder_validate_ptr+0xc5/0x1b0 drivers/android/binder.c:2316
 [<0000000010d5637f>] binder_transaction+0x2091/0x58c0 drivers/android/binder.c:3424
 [<00000000862d8d68>] binder_thread_write+0x593/0x2110 drivers/android/binder.c:3895
 [<00000000daa28519>] binder_ioctl_write_read drivers/android/binder.c:4832 [inline]
 [<00000000daa28519>] binder_ioctl+0xecd/0x1720 drivers/android/binder.c:5008
 [<0000000057dfea1e>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<0000000057dfea1e>] file_ioctl fs/ioctl.c:493 [inline]
 [<0000000057dfea1e>] do_vfs_ioctl+0xb87/0x11d0 fs/ioctl.c:677
 [<000000001a4442fa>] SYSC_ioctl fs/ioctl.c:694 [inline]
 [<000000001a4442fa>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<000000007b26c73f>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
 [<00000000d8753024>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0a 04 00 00 4d 8b 64 24 58 49 29 dc e8 bf 62 0f ff 4d 39 e6 76 07 e8 b5 62 0f ff <0f> 0b e8 ae 62 0f ff 4c 8b 6d d0 4d 29 f4 4d 39 e5 77 e8 e8 9d 
RIP  [<0000000078a38229>] binder_alloc_do_buffer_copy+0xcb/0x500 drivers/android/binder_alloc.c:1103
 RSP <ffff8801cefa74a8>
---[ end trace f9c5daaac9e46c0b ]---